Hi All, I have a sample json event in Splunk as below. Please help me to understand how I can parse custom_tags value from below . This may have multiple key value pairs in it
{
account:xyz,
eventdate:01/25/2024,
properties: {
version:1.0,
requestID: cvv,
response: {"statusCode":"200", "result":"{\"run_id\":465253,\"custom_tags\":{\"jobname\":\"xyz\",\"domain\":\"bgg\"}}}
time:12:55
}
}
Use spath for json data
| spath input=properties
| spath input=response.result custom_tags
| spath input=custom_tags